Quick Take
- The finding: After getting early access to Claude Mythos Preview through Project Glasswing, 13 large US tech firms more than doubled their published software vulnerabilities relative to Chinese firms barred from Anthropic’s models. High-impact flaws rose about two and a half times.
- No bottleneck, no attack wave: Vendors and Linux distributions fixed reported flaws as quickly as before. The share of the firms’ vulnerabilities exploited within a month fell by about two thirds, while the number exploited did not change.
- Bug hunters moved, not quit: External researchers who used to search Glasswing code reported 57% fewer flaws there and shifted to other vendors’ code.
When Anthropic launched Project Glasswing in April 2026, it gave a small group of companies early access to Claude Mythos Preview, a model that finds and exploits software flaws with little human help and that Anthropic said it would not make generally available. A new working paper by economist Thomas Mosk (Queen Mary University of London), “Does Frontier AI Strengthen Cyber Defense? Evidence from Project Glasswing”, estimates what that access did. Using the universe of publicly disclosed vulnerabilities, it asks: did defenders find more, did independent researchers lose out, and did attackers profit?
What the study shows
- More than double the disclosures: Relative to Chinese firms, Glasswing firms’ monthly disclosures rose by 0.784 log points, about 120%. At their pre-launch average of 29 vulnerabilities per firm and month, that is about 36 more each month. Excluding Anthropic itself, the estimate is 0.862.
- Not just the easy bugs: Memory-safety flaws, the class AI finds most easily, roughly doubled. Other flaws rose at least as much, and complex weaknesses such as missing authorization checks rose about as much as machine-verifiable ones. High-impact vulnerabilities rose most, about two and a half times, or about 23 more per firm and month.
- New finds, not a backlog: The median time between reserving an identifier and publishing it fell from 75 to 22 days. Internally found vulnerabilities rose from about 4 to 32 a month per firm, an eightfold increase, while external reports roughly tripled.
- No fixing slowdown: Vendors fixed Zero Day Initiative reports at least as fast as before, and the estimates rule out a slowdown of more than about 13%. Linux distributions such as Debian, Ubuntu, Red Hat and SUSE, which had no access, still shipped fixes after a median of one day.
- External researchers reallocated: A researcher who had worked only on Glasswing code reported 57% fewer Glasswing vulnerabilities after launch and about two and a half times as many in other non-Chinese vendors’ code. The probability of being active in a month did not change.
- Fewer zero-days as a share: The probability that a Glasswing vulnerability was already exploited when disclosed fell by about 70% relative to Chinese firms. Predicted exploitation scores (EPSS) did not change, so the added flaws looked as dangerous as before.
| Outcome (Glasswing vs. Chinese firms) | Pre-launch rate, Glasswing | Change after access |
|---|---|---|
| Exploited within 1 month | 1.42% | −0.92 pp |
| Already exploited at disclosure (zero-day) | 1.20% | −0.85 pp |
| Public exploit code within 1 month | 2.84% | −1.53 pp |
| Predicted exploitation (EPSS, 1 month) | 0.16% | −0.10 pp (not significant) |
Why it matters: Early field evidence on frontier AI in cyber defense
Most evidence on AI and cybersecurity comes from benchmarks and lab demos. This paper measures real-world output in a market where every disclosure leaves a public trace. The setup is unusually clean for an economics study: Anthropic, not the firms, decided who got access, and Chinese firms were barred from all Anthropic models from September 2025, months before the launch. That gives a group that was never treated.
The author also tests the assumptions behind the design. An event study shows no differential trend before early access began in March 2026. A placebo launch one year earlier finds no effect (−0.034). Leaving out any single Glasswing firm gives estimates between 0.691 and 0.872. Because only 13 firms are treated, the paper reports tests designed for few treated units, with p-values of 0.002 or below 0.005. A comparison with 26 large non-Chinese firms gives a smaller but still significant estimate (0.339).
Method in brief
- Data: All 176,384 CVEs published from January 2024 to October 2026, plus 720 Chinese entries without a CVE, combined with the US National Vulnerability Database, CISA’s and VulnCheck’s catalogs of exploited vulnerabilities, public exploit code collections and daily EPSS scores.
- Treatment: The 12 launch partners from April 2026 (AWS, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks) and IBM from May 2026.
- Comparison: 267 Chinese firms, with Russian firms and 26 large non-Chinese firms as robustness checks. The main window runs from October 2025 to September 2026.
- Researchers: Credits from the CVE List, 17 vendor advisory sources and open-source databases give a database of 41,299 researchers. The finder is known for 73% of CVEs.
- Estimation: Difference-in-differences with firm and month fixed effects, using OLS on log counts, Poisson models and linear probability models for exploitation.
What remains open
- Access vs. other AI, not AI vs. no AI: Chinese firms could use domestic models such as DeepSeek V4 and GLM-5.2. The estimate measures what Mythos added relative to those tools.
- Different disclosure rules: Chinese firms disclose under stricter national rules. The author finds no sign of a policy change around the launch, but the groups are not alike.
- Disclosure, not security in use: The data show published and fixed flaws, not whether users installed patches.
- Exploitation is rare: With 13 treated firms, the author reads the decline in exploitation as suggestive rather than established. The counts rule out a doubling of attacks, but not moderate changes.
- Lower bound: Anthropic reported that partners found more than 10,000 high- or critical-severity flaws within a month, far more than the roughly 470 extra disclosures a month the estimates imply. Many may still be unfixed.
- Transparency: This is a single-author working paper without peer review, funding statement or replication files. It relies on public data sources.
Context: From Mythos benchmarks to market outcomes
i10X covered the launch of Project Glasswing and the debate about restricted access to Claude Mythos. The paper adds outside numbers to those claims. According to the US CAISI evaluation it cites, Mythos Preview scored 57.2 on ExploitBench, compared with 38.1 for Claude Opus 4.8, 40.7 for GPT-5.5 and 21.4 for GLM-5.2. Unlike in creative markets, where generative AI raised output but lowered quality, measured quality held up here. Earlier benchmark work on AI security agents showed what models can do in tests; this study shows what happened when firms used one at scale.
What it means for security teams and policymakers
- Finding is no longer the main constraint: Firms with frontier models can disclose far more flaws without slowing fixes, but the gap between found and disclosed flaws suggests that fixing may become the bottleneck.
- Bug bounty markets will shift: Independent researchers move to code the model has not reached. Programs at AI-equipped vendors may need new incentives.
- Access shapes national security: The author argues that a private access restriction works like an export control, creating a security gap between countries.
- Defenders’ edge may be temporary: Once attackers get comparable models, the advantage depends on relative capabilities, the paper warns.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This article is based on the full text of the working paper (arXiv:2611.06629v1, econ.GN, submitted November 4, 2026), including the tables on robustness and exploitation. All numbers come from the paper; i10X did not reanalyze the data. Because the paper is under arXiv’s standard non-exclusive license, the chart was drawn by i10X from Table 3. AI tools assisted with research and drafting; the selection, fact-checking and final editing were done by the i10X editorial team. More company coverage is on our Anthropic page.
i10x Perspective
The story around Mythos has been dominated by fear of AI-powered attacks. This early field evidence points the other way, at least for now: the model helped defenders find flaws before attackers used them. The open question is how long that window stays open, and who gets to be inside it.
